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21 June 1979 Jjfr 


MEMORANDUM FOR THE RECORD 

SUBJECT: The APEX Special Access Control System: 

A Security Manual for Industry; control of 
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1. As Dart of the learning phase for the Industrial Contracting/ 

_* - . — I I r- 4 - 1 A 4- + 4-r\ -f ho Hr T 


Industrial Security Team, 


Special Assistant to the DCI 
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for Compantmentation, briefed us on the proposed new security system. 
He emphasized the sensitivity of the program and the fact that it 
was still in staffing. Accordingly, no disclosure of the infor- 
mation provided would be permitted. 


2. On 13 June 1979, as part of a I - 

contractors, C land I inspected the) 


"Isuryey of 


. . rogram Security Officer, stated that "the new system 
would give them problems with the two person rule plus other 
restrictions. " He indicated that he had the manual and that Mr. 
had been briefed on it. I neither confirmed nor denied the 
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existence of the manual but rather turned the discussion to other 
matters . 


| office, he put a xerox draft 

copy of subject manual on the table. I inspected it and noted^ 


3. Upon return to 
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COpy OT bUUJCUU manual un vut. ~ 

several comments in the margins indicating both a close perusal 

by | | as well as substantial dissatisfaction on his part 

with the two-man rule and other req uirements of t he APEX system. 

He volunteered the information that I | (Security Officer 

f or the I 1) had sent the draft xeroxed manual to him. 

He opined that "now he had gotten I l in trouble." I again did 
not continue the discussion--which he clearly wanted to do- but 
turned to a discussion of document control and other subjects of 
concern to us. 

4. Upon return to Headquarters at 0820, 21 June 1979, I 
advised the Deputy Inspector General of the situation, ask ed him 
to brief the Inspector General and suggested that I advisel I 
I I about the disclosure of the APEX Manual. He agreed and I _ 
subsequently briefed Mr. I I He will discuss the situation with 
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DCI Security. I noted that I would do nothing further unless 
otherwise directed by my superiors and left the matter in his- 
hands. 


Dis tribution : 

Mr. 

Mr. 

D/SEC ; 
C/SS/0D&E 
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APEX CONTROL SYSTEM MANUAL 




INDUSTRIAL SECURITY BRANCH COMMEN T S 


GENERAL COMMENTS 


!• Inasmuch as the APEX Control Manual sets forth policy 
standards andprocedures to protect Sensitive Compartmented 
Information, it is recommended that the manual itself be 
classified since it, in itself, is an intelligence method. 

If it is not classified, it will be available to anyone 
under the Freedom of Information Act. 


2. It should be recognized that if the 1973 USIB Standards 
for setting forth the physical security requirements for the 
protection of Sensitive Compartmented Information are utilized 
intended for the protection of Sensitive Compartmented 
Information controlled by the APEX Security Control System, 
then that protection is weak and is not compatible with the 
statement in Section 2 of the APEX Control System Manual, which 
states that EO 12065 recognized the need to establish special 
access programs to control access, distribution, and protection 
of particularly sensitive classified information, etc. 


SPECIFIC COMMENTS 


Cover Memorandum dated 
26 January 1979 from I 


-Paragraph 7 of this memorandum 
indicates that guidance regarding 
Sections VII e, f, and g would not 
be part of the Manual. We have 
included comments on these items 
(changes in personal status, 
contacts or association with 
foreign nationals, alien marriages 
and travel and duty assignment 
restrictions) in our drafts of the 
Industrial Security Manuals. For 
the sake of uniformity, should the 
Government manual not also include 
such instructions? 
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Page 1, last line 


Page 4, line 1 


Page 5, line 5 


Page 10, first four 
paragraphs 


Page 10, paragraph C 


Page 13, paragraph i 


Page 14, paragraph VI b 


-Suggest the insertion of the v 

word "control” between "individual" 
and "system." 

-Suggest this sentence begin as 
follows: "In order to protect 
highly..." etc. 

-Suggest the phrase "within 30 days" 
be replaced by the phrase "30 days ' 
before." 

-Will there be any written evidence 
in the security files of an 
individual which attests to the 
operational or product compartments 
within the Apex Control System, 
to which he had had access? 


-Do the words "as appropriate" 
modify the persons named in the 
first sentence, or do they modify 
the whole statement in the first 
sentence, so that annual 
rejustification would not be 
required until that were considered 
appropriate? 



-Shouldn’t these individuals be 
bound by an Apex Secrecy Agreement? 
If not, there are no limitations 
on these individuals not to 
disclose Apex Control Information. 


-Since this is such sensitive 
information, would it not be a 
good idea to limit the knowledge, 

* even within the Central Access 

Approval Registry, of the names of 
the pe ople who are accessed to 

I data? 25 


2 
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Page 15, lines 2, 3, and 4 


Page 15, Section c, second 
paragraph 


Page 16, first paragraph 


Page 17, paragraph VII a.l 


Page 18, Paragraph VII b.5 


Page 19, line 10 


Page 20, line 8 


-Should not this sentence read, 

"Status, rank, and position are 
not in themselves sufficient reasons 
to establish the cl early demonstrated 
needs to see | | data?" 25 

-Should not the Two-Person Rule 
be exercise d when it is necessary 
to transmit I [information A/ '25 

outside the | control office' * 

area? If not, an individual . ' 
would have the opportunity to 
copy this very sensitive information 
if he chose to. 

-Will | 1 material be open-shelf 25 

stored or should it not be always r A 
secured in a GSA- approved security V' 
container or in a drawer with a 
separate control drawer head in 
a GSA- approved security container? 

- - ^ vi- d 

-DCID 1/19 is appropriate as far as 
it goes. But is doesn't include the 
Two-Person Rule and other various 
items. It could, or course, be I 

amended to include them. \ 

-This paragraph requires rebriefing 
on at least a bi-annual basis. 

The DCI and Director of Security 
have asked for annual rebriefings, , 
at least in industry. Is this 1 

consistent with their intent-?. • ; ,/ . 

.. . - 

-What is a timely basis? The problem 
with CIB records now is that they 
are always out of date. 

-Same comment as on page 16, first 
paragraph. 
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Page 20, paragraph 6 -See comment regarding page 15, 

Section c, second paragraph. 

Page 23, Section c -Suggest first sentence begin as 

follows: "Security approval for 
access to. . . " 

-Suggest the title of DCID 1/14 
be capitalized, since it is a 
formal title. 

Page 23, Section d, lines 6 -Suggest phrase "for inclusion in the 

and 7 Central APEX Registry" be changed 

to read "in order to update the 
information maintained in the 
Central APEX Registry." 

Page 24, Section e -This section does not make it 

clear that casual contacts with 
V hostile country nationals should 
^ or should not be reported. Should 
they? What is a casual contact? 

-Also, since Section VII e, f, and g 
will apparently not be in the APEX 
Manual, where \irill they appear? 

Will each Agency issue its own 
instructions or will these be a 
Uniform sect of instructions issued 
By SECOM? 

Page 25, line 4 -Suggest the phrase "are accessed" be 

struck and replaced with the phrase 
"who have been approved and briefed 
for access . . . " 

Pages 32 and 33, section c -The common badge system appears to 

be a poor method to be utilized for 
establishing prima facie evidence 
of the approval status of an 
\ individual’s access to various APEX 
compartments. It seems that it 
would be difficult to keep this 
badge up to date and problems would 
be encountered in attempting to 
continuously revalidate the badges. 
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Page 41, Section c, line 3 


^-Will the two couriers be required to 
^ be approved and briefed for access 
to APEX- General? 


Page 42, lines 3, 4, and 5 


Page 45, Section f 


Page 52, Section XV a 


Page 53, Section b, line 6 


■0D§E uses two staff type co ntract 
couriers only on local runs ~ 

| and on overseas 
runs sometimes. They do not 
generally use two couriers on 



-Does the prohibition to transmit 
vAPEX material via commercial air- 
Xcraft preclude the use of 0D§E 
^couriers who now use commercial air- 
craft? Also, how can there be an 
exception to something that is 
prohibited? It appears that the 
wording should be changed. 

-It is recognized that approved 
destruction methods must be used, 
v But who really approves the methods? 
The destruction devices themselves 
receive technical approval from 
a different source, and each Agency 
seems to have different criteria. 

-Should this paragraph not also 
include specific reference to 
DCID 1/14 requirements? 

-The Department of Defense, in 
DOD 5220. 22-M, paragraph 21c 
(Foreign Ownership, Control or 
Influence) requires notification by 
^ any investor who as aquired direct 
or indirect beneficial interest 
of five percent or more , not six 
percent 
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Page 57, paragraph 3 


Page 57, paragraph 4 
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-How does the "anyone other than 
elected members of the House 
and Senate" jibe with the statement 
on Page 54, paragraph XVI a.l, 
which states that members of 
Congress will be granted APEX access 
provided need- to-known require- 
ments have been established? 

-Will the Two-Person Rule he used? 


